---
title: CVE-2006-4346
description: Ubuntu is an open source software operating system that runs from the
  desktop, to the cloud, to all your internet connected things.
url: https://ubuntu.com/security/CVE-2006-4346
---

# CVE-2006-4346

Publication date 24 August 2006

Last updated 17 July 2025

---

Ubuntu priority

**Medium**

[Why this priority?](https://ubuntu.com/security/cves/about#priority )

Toggle side navigation

## Description

Asterisk 1.2.10 supports the use of client-controlled variables to
determine filenames in the Record function, which allows remote attackers
to (1) execute code via format string specifiers or (2) overwrite files via
directory traversals involving unspecified vectors, as demonstrated by the
CALLERIDNAME variable.

## Status

Show unmaintained releases

| Package | Ubuntu Release | Status |
| --- | --- | --- |
| asterisk | 9.10 karmic | Fixed 1.4.11~dfsg-1 |
| 9.04 jaunty | Fixed 1.4.11~dfsg-1 |
| 8.10 intrepid | Fixed 1.4.11~dfsg-1 |
| 8.04 LTS hardy | Fixed 1.4.11~dfsg-1 |
| 7.10 gutsy | Fixed 1.4.11~dfsg-1 |
| 7.04 feisty | Fixed 1.2.16~dfsg-1ubuntu3.1 |
| 6.10 edgy | Fixed 1.2.12.1.dfsg-1ubuntu1.4 |
| 6.06 LTS dapper | Ignored end of life |

---

* [How can I get the fixes?](https://ubuntu.com/security/cves/about#security)
* [What do statuses mean?](https://ubuntu.com/security/cves/about#statuses)

## References

* [MITRE](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-4346)
* [NVD](https://nvd.nist.gov/vuln/detail/CVE-2006-4346)
* [Launchpad](https://launchpad.net/bugs/cve/CVE-2006-4346)
* [Debian](https://security-tracker.debian.org/tracker/CVE-2006-4346)

### Other references

* <https://www.cve.org/CVERecord?id=CVE-2006-4346>